MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f9b89b7ec9274a6fcf824714468449f8396485a558a756306ac2c12b7a2bcd8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7f9b89b7ec9274a6fcf824714468449f8396485a558a756306ac2c12b7a2bcd8
SHA3-384 hash: ca8e1708f9d08b26fcb6998f04b31f2d59d8514873c3c994874f8575419b2a9960e34ba8d746c7ead77fc1db6a03b53f
SHA1 hash: c0bc91280a752a2d5e9392a0e9fc45046725d8d7
MD5 hash: 3f5f7d215450de97f7902ca9a6f53c7b
humanhash: lamp-oranges-solar-uncle
File name:PURCHASE ORDER 11052020_pdf.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:267'672 bytes
First seen:2020-05-11 09:01:16 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:91BmVJBvHdtP5cNJQ5wikGKsb7ysiWlPgrnT69FSDjUlf1D/l0:918VJ9/h4JQ+4+dWlPY69FSDwj/l0
TLSH 8E4423E627D44E813E0478A746F2380C52CC4FA22A16B6734705AD16E4EB3D8BC9636F
Reporter cocaman
Tags:FormBook rar


Avatar
cocaman
Malicious email
From: "CHANGZHOU JIAHONG (Sales Manager)" <master@top-jh.cn>
Received: from mail.apartacel.com (apartacel.com [200.52.172.106])
Date: Mon, 11 May 2020 08:31:06 +0100
Subject: RE:Order by Petersen Matex Trading GmbH
Attachment: PURCHASE ORDER 11052020_pdf.rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 09:36:33 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=p6nytn7msj2kn7hyeryui2cet6bzmsc2kwfhkyygvqwbfn5cxtma._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 7f9b89b7ec9274a6fcf824714468449f8396485a558a756306ac2c12b7a2bcd8

(this sample)

FormBook

Executable exe bbb3afd846cc51e61380effeaceabc21e15c8b4ccdab6d821697191605a00c60

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bbb3afd846cc51e61380effeaceabc21e15c8b4ccdab6d821697191605a00c60
  
Dropping
FormBook

Comments